What's the danger of not encoding brackets in URL?

StackOverflow https://stackoverflow.com/questions/20909959

  •  24-09-2022
  •  | 
  •  

Question

I have read this question: Is it ok to have brackets in URL? and the related RFC 3986.

Answers to this question say that [ and ] are classified as gen-delims by the RFC and should therefore be encoded, but do not explain how failing to do so would be problematic.

So, I fail to understand what can be the problem with a URL such as:

http://example.com/?foo[bar]=baz

It is obvious why & should be encoded for example, as it is used as a separator between query parameters.

But what is the use of [ and ] in a URL that would make their intent confusing if they were not URL-encoded?

Was it helpful?

Solution

From RFC 3986 section 3.2.2:

A host identified by an Internet Protocol literal address, version 6 [RFC3513] or later, is distinguished by enclosing the IP literal within square brackets ("[" and "]").

For example, the IPv4 address for you local machine is 127.0.0.1, so you can access it with the url

http://127.0.0.1/

The IPv6 equivalent is ::1, so the url would be

http://[::1]/
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top